HealthCopilot — Integration Ecosystem

Integration Stack — read bottom-up: data in → users out

Layer 6 👥

End Users & External SystemsWho interacts with the platform

Members Brokers / Agents Ops Agents & Supervisors Clinical Reviewers Executives / Analytics IT / Developer Teams

↑

Layer 5 🖥️

Ready-Made Portals & AppsWhite-label, zero-build

Member Web Portal Member Mobile App Broker Portal Agent Workspace Supervisor Dashboard Clinical Reviewer Workspace Analytics & Reporting Portal

↑

Layer 4 🧩

SDKs & Embeddable ComponentsBuild your own UI on our engine

Chat Widget (iframe embed) White-label AI Avatar Bootstrap Config API iOS SDK (Swift) Android SDK (Kotlin) React Native SDK JavaScript / TypeScript SDK Mobile WebView Integration

↑

Layer 3 ⚡

Core APIs & Real-Time EventsOpenAPI 3.0 · versioned · sandboxed

REST API (OpenAPI 3.0) 40+ Webhooks GraphQL Batch / Bulk API OAuth 2.0 · API Keys · mTLS Sandbox Environment Event Replay Rate Limit Controls

↑

Layer 2 🤖

AI + Business Logic PlatformWhere rules, AI, and data combine

NLU Intent Engine 4-Phase Conversation Engine Claim Status Interpreter Benefit Explainer Handoff & Escalation Engine Document OCR Pipeline Persona & Behavioral Engine Opportunity Intelligence Access & Consent Governance

↑

Layer 1 🗄️

Data Ingestion & Mapping EngineAny format, any source, normalized

HL7 FHIR R4 CSV / Excel / XML / JSON REST API Pull SOAP / WSDL FTP / SFTP Batch DB Connectors (PG, Oracle, MSSQL) Kafka / RabbitMQ Streams Field Mapping & Normalization Data Quality Scoring

📥

File & Batch Import

All standard insurance data formats

Inbound

📄
HL7 FHIR R4 — clinical data, encounters, diagnoses, procedures, observations Clinical Standard
📊
CSV / Excel — member rosters, plan tables, provider networks, historical claims
🗂
XML / EDI X12 — 837 claim submissions, 835 remittance, 270/271 eligibility, 278 preauth
📁
JSON flat files — policy data, benefit schedules, pricing tables
🔄
FTP / SFTP batch — scheduled overnight file drops from TPA or core systems

🔌

Live Connectors

Real-time and near-real-time feeds

Bidirectional

⚡
REST API pull — scheduled or on-demand sync from TPA / claims systems
🧩
SOAP / WSDL — legacy core system integration without re-platforming Legacy friendly
🗃
Database connectors — PostgreSQL, Oracle, SQL Server, MySQL, read replicas supported
📡
Kafka / RabbitMQ — real-time event streaming from claims processing engines
🔁
Change-data capture — subscribe to row-level changes from source systems without polling

🗺

Field Mapping & Normalization

Schema translation engine

Transform

🔀
Visual field mapper — drag-and-drop source → canonical field mapping, no coding
📐
Transformation rules — date normalization, currency, code lookup tables (ICD-10, CPT, DRG)
✅
Data quality scoring — completeness, consistency, and freshness metrics per imported batch
⚠️
Anomaly detection — flags duplicate member IDs, amount outliers, missing required fields
🕒
Incremental sync — delta import since last run; full re-sync on demand

📄

Document Intelligence Pipeline

Structured extraction from unstructured docs

AI-assisted

🔍
Medical invoices — provider name, diagnosis codes, procedure codes, amounts, dates
💊
Prescriptions — drug name, dosage, prescribing physician, validity period
🧪
Lab reports — test names, reference ranges, abnormal flags
🏥
Discharge summaries — admission/discharge dates, diagnosis, follow-up instructions
🛡
Deterministic review gate — 15 reason codes gate all AI-extracted fields before use Hard control

⚡

REST API

OpenAPI 3.0 · versioned · sandbox-ready

Outbound

📘
OpenAPI 3.0 specification — auto-generated interactive docs, Postman collection included
🔢
Versioned endpoints — /v1/, /v2/ with no breaking change policy per major version
🧪
Sandbox environment — realistic synthetic data for integration testing, mirrors production behavior
🔑
Auth — OAuth 2.0 (client credentials + PKCE), API keys, mTLS for server-to-server Secure
🚦
Rate limiting — per-tenant, per-endpoint controls; burst allowance configurable
🌐
Key resource groups: /members, /claims, /preauth, /benefits, /providers, /conversations, /queue, /documents, /analytics

🔔

Outbound Webhooks

HealthCopilot → your systems · events we generate

Push

🤝
Handoff & case events — handoff.triggered, handoff.assigned, handoff.resolved, handoff.transferred, case.created, case.escalated, case.resolved
📄
Document events — document.uploaded, document.extracted, document.review_required, document.approved
📋
Queue & action events — queue_item.created, queue_item.assigned, queue_item.resolved, action.completed
📣
Notification & callback events — notification.sent, callback.scheduled, callback.completed
🔁
Event replay — re-deliver any event up to 30 days back; guaranteed delivery with exponential retry

📡

Inbound Push Events

Your systems → HealthCopilot · signals we consume

Receive

👤
Member lifecycle — member.enrolled, member.verified, member.linked, eligibility.updated From your TPA / core
🏥
Preauth decisions — preauth.received, preauth.approved, preauth.denied, preauth.expired — when authorization is received from your system, we timestamp and store it so members can ask "when was my authorization received?" Tracked
📋
Claim status changes — claim.approved, claim.rejected, claim.paid — sourced from your claims processing engine
📜
Policy events — policy.issued, policy.renewed, policy.cancelled — from your policy administration system
🔐
Signature verification — all inbound payloads validated via HMAC-SHA256 shared secret

🔶

GraphQL API

Flexible member data queries

Flexible

🔍
Member 360 queries — fetch member, claims, benefits, preauths, documents in one call
📊
Aggregate analytics — claim volumes, utilization, resolution rates, handoff rates
🔒
Field-level permissions — PII fields gated by role + consent, same governance as REST
📡
Subscriptions — real-time GraphQL subscriptions for live claim status tracking

📦

Batch / Bulk API

High-volume operations and exports

Bulk

👥
Bulk member import — onboard thousands of members from CSV/JSON in a single API call
📋
Bulk claim export — full claim history with filters: date range, status, provider, member group
📊
Analytics export — conversation logs, intent distribution, resolution rates, AI confidence trends
🔄
Async job pattern — large jobs return a job ID; poll or receive webhook on completion
🗃
Output formats — CSV, NDJSON, Parquet (for data warehouse ingestion)

🌐

Web Embed

JavaScript / TypeScript · iframe-based

Web

💬
Iframe embed — Bootstrap API returns a fully-configured embed URL; host drops it into any web page in minutes
🎨
Theming — brand colors, logo, border radius, and dark/light mode injected at session init via Bootstrap Config API
🔌
Event hooks — onHandoff, onClaimView, onIntentDetected, onSessionEnd — postMessage API across the iframe boundary
🔑
Session tokens — short-lived embed tokens scoped per member and tenant; no credentials exposed to the host page
🌍
i18n — EN / AR out of the box; RTL layouts supported natively

📱

Mobile SDKs

iOS · Android · React Native

Mobile

🍎
iOS (Swift) — UIKit + SwiftUI, embeddable chat view controller
🤖
Android (Kotlin) — Jetpack Compose + XML layouts supported
⚛
React Native — single JS package, native modules for camera (OCR upload) & biometrics
🔐
Biometric auth — Face ID, Touch ID, fingerprint for session security
📷
Document capture — in-SDK camera for prescription/invoice OCR upload

🧩

Embed Capabilities

What the host can control and observe

Configurable

🤖
White-label AI Avatar — configurable persona name, avatar variant, tone profile, and brand color; host app sets at bootstrap
📐
SDK Kit Manifest — generated per tenant and channel; includes embed URL, allowed origins, iframe attributes, and auth config in one document
📱
Mobile WebView integration — embed shell is WebView-compatible; mobile_app_container channel profile constrains layout, card count, and action density automatically
🔒
Origin allowlist — each embed token is bound to registered host origins; cross-origin injection is blocked at the token level
🎭
UI mode switching — standalone, inline, or floating widget layout selectable per channel instance

👤

Member Portal & App

Web + iOS + Android

Member-facing

💬
AI Copilot chat — 24/7 claim, benefit, and preauth support
📋
Claim history, status timeline, document upload
🏥
Provider search — in-network, by specialty and location
📄
Digital insurance card, benefit summary, policy documents
🔔
Push notifications for claim decisions and preauth updates
🌍
Arabic / English, RTL support

🤝

Broker Portal

Self-service for intermediaries

B2B

📊
Analytics — claim volumes, preauth approval rates, turnaround times by group
💬
AI Copilot access — broker-scoped assistant for client queries and benefit lookups
🔌
REST API access — bulk member operations, webhook subscriptions, data export
🔑
SAML 2.0 SSO — brokers authenticate via their own identity provider

🎛

Ops Portals

Agent · Supervisor · Clinical Reviewer

Internal

🧑‍💼
Agent Workspace — live queue, AI assist, full member context, case management
📊
Supervisor Dashboard — queue health, SLA tracking, agent performance, escalation review
🩺
Clinical Reviewer — document review queue, OCR field verification, decision recording
🎨
All white-labelable — logo, color palette, domain name, email templates
🔒
RBAC — 8 roles with field-level permission controls

🏛

Insurance Core Systems

TPA / Core

TPA platforms
Policy administration systems
Claims processing engines
Pricing & underwriting systems
Reinsurance data feeds

📣

Communications

Omnichannel

Email (SMTP, SendGrid, SES)
SMS (Twilio, AWS SNS, local carriers)
WhatsApp Business API
Push notifications (FCM, APNs)
In-app messaging

🔐

Identity & Auth

Identity

SAML 2.0 (SSO)
OIDC / OAuth 2.0
Azure Active Directory
Okta, Auth0
LDAP / on-prem Active Directory
National ID / eKYC verification

📁

Document Storage

Storage

AWS S3 / compatible object stores
SharePoint Online
OneDrive for Business
Azure Blob Storage
On-premises NAS / DMS

📊

Analytics & BI

Analytics

Power BI (certified connector)
Tableau, Looker, Metabase
Snowflake, BigQuery, Redshift
Azure Synapse, Databricks
Custom data warehouse via Parquet export

🛡

Compliance & Security

GRC

GDPR data export & erasure APIs
Audit log streaming (SIEM)
Splunk, Azure Sentinel, Datadog
DLP integration hooks
Regulator reporting data feeds

User Type	Primary Interface	API Access	Data They See	Auth Method	Channel
👤 Member / Patient Insured individual	Member Web Portal Mobile App Chat Widget WhatsApp Bot	Read own claimsRead benefitsSubmit documents	Own claims, benefits, preauths, providers in network, policy docs	OTP / PasswordBiometricNational ID	Web · Mobile · WhatsApp · Email
🤝 Broker / Agent Intermediary	Broker Portal REST API	Group managementWebhook subscriptionsAnalytics export	Their groups, aggregate utilization, enrollment status, commission data	SAML 2.0 SSOOAuth 2.0	Web · API · Email
🧑‍💼 Ops Agent Customer care	Agent Workspace	— Internal tools only	Assigned queue items, member context, AI assist panel, case history	SSO / LDAPMFA	Web (internal)
📊 Supervisor Team manager	Supervisor Dashboard Analytics Portal	Queue managementAgent oversightReporting API	All queues, full member view, agent performance, SLA metrics, AI audit logs	SSO / MFA	Web (internal)
🩺 Clinical Reviewer Medical professional	Reviewer Workspace	— Internal tools only	Document OCR results, medical extraction fields, clinical decision record	SSO / MFA	Web (internal)
💻 IT / Developer Integrating teams	REST API SDKs GraphQL Webhooks Sandbox	Full API surfaceBatch opsData export	Scoped by tenant permissions and OAuth scopes; PII requires explicit consent grants	OAuth 2.0API keysmTLS	REST · GraphQL · SDK · Webhook
📈 Executive / Analytics Leadership	Analytics Portal Power BI Snowflake	Read-only reportingData warehouse export	Aggregate KPIs, claim financials, resolution rates, AI performance, member satisfaction	SSO	Web · BI Tools · Data Warehouse